https://bugs.winehq.org/show_bug.cgi?id=45160
--- Comment #2 from Rosanne DiMesio dimesio@earthlink.net --- I wouldn't assume that HTML and CSS are inherently safe. IMO, the biggest security holes in the AppDB are the HTML WYSIWYG textareas in the test report submission form (bug 34647).
As for the CDN, I believe that's used for bandwidth/economic reasons, so I expect that's unlikely to change.